CyberGlossary

Forensics & IR

DFIR (Digital Forensics and Incident Response)

Also known as: Digital forensics and incident response

Definition

A combined discipline that fuses digital forensic investigation with incident response to detect, contain, eradicate, and learn from cyber incidents.

DFIR teams operate during and after security incidents to understand what happened, scope the impact, evict the adversary, and produce evidence-grade findings. Workflows align with NIST SP 800-61 for incident handling and NIST SP 800-86 / ISO/IEC 27037 for evidence handling, blending live response (EDR queries, triage collections with KAPE or Velociraptor) with full forensic acquisition when warranted. Analysts pivot across endpoint, memory, network, and cloud telemetry to reconstruct TTPs mapped to MITRE ATT&CK. Outputs include indicators of compromise, root cause, remediation guidance, and lessons-learned that strengthen detection and prevention.

Examples

  • A DFIR retainer activates after a ransomware detonation: triage with Velociraptor, image key hosts, and write a containment plan.
  • Reconstructing an APT intrusion across endpoints and cloud logs to identify initial access and lateral movement.

Related terms